[RFC] qcom-firmware-sign: build-time secure-boot signing of Qualcomm firmware

recipes-devtools/sectools/sectools-native_1.48.0.bb

@@ -0,0 +1,47 @@
+SUMMARY = "Qualcomm Sectools v2 -- image signing / verification tool"
+DESCRIPTION = "Qualcomm Security Tools v2: the host \
+binary used to sign, verify and inspect Qualcomm firmware images (XBL, \
+TZ, modem, etc.) according to a per-chipset Security Profile XML"
+HOMEPAGE = "https://softwarecenter.qualcomm.com/catalog/item/Qualcomm_Security_Tools"
+LICENSE = "LICENSE.qcom-2"
+
+LIC_FILES_CHKSUM = "file://${UNPACKDIR}/${ZIP_TOPDIR}/CHANGES.txt;md5=d2a0bb01dcd8befe660b832fbbe05900"
+ZIP_TOPDIR = "1.48"
+
+SRC_URI = "https://softwarecenter.qualcomm.com/api/download/software/tools/Qualcomm_Security_Tools/All/${PV}/${ZIP_TOPDIR}.zip;name=sectools-zip;downloadfilename=qcom-sectools-${PV}.zip"
+SRC_URI[sectools-zip.sha256sum] = "d89773bbfcc9c80c871b628bd2e766460a876277661ed6634d57590b7fd80fba"
+
+S = "${UNPACKDIR}/${ZIP_TOPDIR}"
+
+INHIBIT_DEFAULT_DEPS = "1"
+
+inherit native
+
+do_configure[noexec] = "1"
+do_compile[noexec]   = "1"
+
+# Pick the per-platform sectools binary that matches the build host.
+SECTOOLS_PLATFORM_DIR = "${@'Linux_aarch64' if d.getVar('BUILD_ARCH') == 'aarch64' else 'Linux'}"
+
+# Stage the per-platform sectools binary under ${datadir}/sectools/ and
+# drop a thin symlink into ${bindir} so consumers can invoke `sectools`
+# from PATH regardless of which subdir was selected.
+do_install() {
+    install -d "${D}${datadir}/sectools/${SECTOOLS_PLATFORM_DIR}"
+    install -m 0755 "${S}/${SECTOOLS_PLATFORM_DIR}/sectools" \
+        "${D}${datadir}/sectools/${SECTOOLS_PLATFORM_DIR}/sectools"
+
+    install -d "${D}${bindir}"
+    ln -sf "../share/sectools/${SECTOOLS_PLATFORM_DIR}/sectools" \
+        "${D}${bindir}/sectools"
+
+    install -m 0644 "${S}/CHANGES.txt" "${D}${datadir}/sectools/CHANGES.txt"
+}
+
+do_unpack[postfuncs] += "sectools_chmod_unpacked"
+sectools_chmod_unpacked() {
+    chmod -R u+w "${UNPACKDIR}"
+}
+
+FILES:${PN} += "${datadir}/sectools"
+INSANE_SKIP:${PN} += "already-stripped"

recipes-devtools/security-profiles/security-profiles-native_git.bb

@@ -0,0 +1,22 @@
+SUMMARY = "Qualcomm Security Profiles"
+DESCRIPTION = "Per-chipset Security Profile XML files consumed by Sectools"
+HOMEPAGE = "https://github.com/qualcomm/security-profiles"
+LICENSE = "BSD-3-Clause-Clear"
+LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=2998c54c288b081076c9af987bdf4838"
+
+SRC_URI = "git://github.com/qualcomm/security-profiles.git;protocol=https;branch=main"
+SRCREV = "122f1917af2b428880a7607ed705bb46bec66f5b"
+
+inherit native
+
+do_configure[noexec] = "1"
+do_compile[noexec]   = "1"
+
+# Install the XML profiles into a well-known native datadir location
+# so qcom-firmware-sign.bbclass can resolve them by filename via
+# QCOM_FIRMWARE_SIGN_SECPROFILE.
+do_install() {
+    install -d "${D}${datadir}/qcom-security-profiles"
+    install -m 0644 "${S}"/*_security_profile.xml \
+        "${D}${datadir}/qcom-security-profiles/"
+}